Log Forwarding

Users who belong to the System Admins group can forward server audit records and KMIP and NAE activity logs to Elasticsearch or Loki or both. These log forwarders are part of log stacks — Elastic Stack or Grafana Loki — which provide powerful tools for querying, analyzing and visualizing CipherTrust Manager log entries. See Elastic Stack documentation and Grafana Loki documentation for full details on log forwarder operations and capabilities.

CipherTrust Manager always stores logs locally in addition to forwarding to configured log forwarders.

In a clustered environment, log forwarder configuration is replicated across the cluster. The currently active node sends log forwarder messages. This means that if you perform a logged operation on a node, that node sends the log record to the log forwarder.

Configuring Elasticsearch Connection

Elasticsearch connections can be authenticated with username and password or unauthenticated. Check the Elasticsearch deployment for the authentication required for incoming data.

These connections can additionally use TLS for an added layer of protection, indicated by providing a Certificate Authority (CA) certificate during connection configuration. By default, CipherTrust Manager attempts to validate Elasticsearch's server certificate using the provided CA. The external CAs already present on CipherTrust Manager are not used. You can disable certificate validation for TLS if desired.

You can add an index name to KMIP activity logs, NAE activity logs, and audit records to help with queries in the Elasticsearch environment.

To add an Elasticsearch connection you need to provide the following values:

• A name for the log forwarder configuration

• The hostname for connecting to Elasticsearch

• The port for Elasticsearch to listen on

You can optionally provide the following values:

• An index name for KMIP activity logs

• An index name for NAE activity logs

• An index name for server records

• A trusted CA certificate. This can be provided as a file or as text. Providing a certificate indicates that the connection uses TLS. If you intend to have CipherTrust Manager validate Elasticsearch's server certificate, which is the default behavior, provide a CA which directly or indirectly signs the server certificate.

• A setting for CipherTrust Manager to skip certificate verification when using TLS. Use the insecure-tls-skip-verify flag to indicate that CipherTrust Manager does not verify Elasticsearch's presented server certificate.

• An HTTP username for authentication.

• An HTTP password for authentication.

Syntax for Elasticsearch With TLS

ksctl log-forwarders add elasticsearch --host <elasticsearch_hostname_or_IP> --port <listening_port> {--ca-cert <trusted_ca_certificate_text>|--ca-cert-file  <trusted_ca_certificate_file>} [--insecure-tls-skip-verify]  [--index-activity-kmip <kmip_index_name>] [--index-activity-nae <nae_index_name>] [--index-server-audit-records <server_records_index_name>]

Syntax for ElasticSearch with Password Authentication

ksctl log-forwarders add elasticsearch --host <elasticsearch_hostname_or_IP> --port <listening_port> --http-user <username_for_http_authentication> --http-passwd <password_for_http_authentication> [--index-activity-kmip <kmip_index_name>] [--index-activity-nae <nae_index_name>] [--index-server-audit-records <server_records_index_name>]

Configuring Loki Connection

Loki connections can be unauthenticated or authenticated with username and password. Check the Loki Grafana deployment for the authentication required for incoming data. You can add labels to KMIP activity logs, NAE activity logs, and server logs to help with queries in the Loki Grafana environment.

To add a Loki log forwarder, you must provide the following values:

• A name for the log forwarder configuration

• The hostname for connecting to Loki

• The port for Loki to listen on

You can optionally provide the following values:

• a user name for HTTP authentication

• a password for HTTP authentication

• labels field for KMIP activity logs

• labels field for NAE activity logs

• labels field for server records

Syntax for Loki With Password Authentication

ksctl log-forwarders add loki --host <loki_hostname_or_IP> --port <listening_port> --http-user <username_for_http_authentication> --http-passwd <password_for_http_authentication> [--labels-activity-kmip <kmip_index_name>] [--labels-activity-nae <nae_index_name>] [--labels-server-audit-records <server_records_index_name>]

Syntax for Loki with No Authentication

ksctl log-forwarders add loki --host <loki_hostname_or_IP> --port <listening_port> [--labels-activity-kmip <kmip_index_name>] [--labels-activity-nae <nae_index_name>] [--labels-server-audit-records <server_records_index_name>]

Viewing Log Forwarders

You can use ksctl log-forwarders get --id <log-forwarder-identifier> to view details for a particular log forwarder.

You can use ksctl log-forwarders list to view details for all log forwarders.

The returned details include ID, name, type (Loki or Elasticsearch), CipherTrust Manager user account, hostname, port, ElasticSearch indicies, and Loki labels.

Updating Elasticsearch Log Forwarder

The following values can be modified for an Elasticsearch log forwarder:

• A name for the log forwarder configuration

• The hostname for connecting to Elasticsearch

• The port for Elasticsearch to listen on

• An index name for KMIP activity logs

• An index name for NAE activity logs

• An index name for server records

• A trusted CA certificate. This can be provided as a file or as text. Providing a certificate indicates that the connection uses TLS. If you intend to have CipherTrust Manager validate Elasticsearch's server certificate, which is the default behavior, provide a CA which directly or indirectly signs the server certificate.

• A setting for CipherTrust Manager to skip certificate verification when using TLS. Use the insecure-tls-skip-verify flag to indicate that CipherTrust Manager does not verify Elasticsearch's presented server certificate.

• HTTP username and password for authentication. There is an option to provide the authentication password after a prompt for the modify command, for improved security. CipherTrust Manager stores these values and sends them along with log forwarding requests.

Syntax for Updating Elasticsearch Log Forwarder for TLS

ksctl log-forwarders modify elasticsearch --id <elasticsearch-resource-id> --host <elasticsearch_hostname_or_IP> --port <listening_port> {--ca-cert <trusted_ca_certificate_text>|--ca-cert-file  <trusted_ca_certificate_file>} [--insecure-tls-skip-verify]  [--index-activity-kmip <kmip_index_name>] [--index-activity-nae <nae_index_name>] [--index-server-audit-records <server_records_index_name>]

Syntax for Updating ElasticSearch for Password Authentication

ksctl log-forwarders modify elasticsearch --id <elasticsearch-resource-id> --host <elasticsearch_hostname_or_IP> --port <listening_port> --http-user <username_for_http_authentication> --http-passwd <password_for_http_authentication> [--index-activity-kmip <kmip_index_name>] [--index-activity-nae <nae_index_name>] [--index-server-audit-records <server_records_index_name>]

Updating Loki Log Forwarder

The following values can be modified for a Loki log forwarder:

• A name for the log forwarder configuration

• The hostname for connecting to Loki

• The port for Loki to listen on

• Labels field for KMIP activity logs

• Labels field for NAE activity logs

• Labels field for server records

• A user name and password for HTTP authentication. There is an option to provide the authentication password after a prompt for the modify command, for improved security. CipherTrust Manager stores these values and sends them along with log forwarding requests.

Syntax for Updating Loki With Password Authentication

ksctl log-forwarders modify loki --id <loki_resource_id> --host <loki_hostname_or_IP> --port <listening_port> --http-user <username_for_http_authentication> {--http-passwd <password_for_http_authentication>|--http-passwd-interactive}[--labels-activity-kmip <kmip_index_name>] [--labels-activity-nae <nae_index_name>] [--labels-server-audit-records <server_records_index_name>]

Syntax for Updating Loki with No Authentication

ksctl log-forwarders modify loki --id <loki_resource_id> --host <loki_hostname_or_IP> --port <listening_port> [--labels-activity-kmip <kmip_index_name>] [--labels-activity-nae <nae_index_name>] [--labels-server-audit-records <server_records_index_name>]

Deleting a Log Forwarder

To delete a log forwarder, use ksctl log-forwarders delete --id <log-forwarder-unique-identifier>.